Mozilla Foundation Security Advisory 2013-70

Bypass of XrayWrappers using XBL Scopes

Announced

August 6, 2013

Reporter

Bobby Holley, moz_bug_r_a4

Impact

Moderate

Products

Firefox, SeaMonkey

Fixed in

Firefox 23

SeaMonkey 2.20

Description

Mozilla Developer Bobby Holley and Mozilla security
researcher moz_bug_r_a4 discovered a mechanism where XBL scopes
can be be used to circumvent XrayWrappers from within the Chrome on unprivileged
objects. This allows web content to potentially confuse privileged code and
weaken invariants and can lead to cross-site scripting (XSS) attacks.

In general these flaws cannot be exploited through email in the
Thunderbird and SeaMonkey products because scripting is disabled, but are
potentially a risk in browser or browser-like contexts in those products.